Quick Summary
- The Cyprus IP Box gives an 80% deduction on qualifying profits from software, APIs, patents, and utility models.
- Effective tax rate in 2026: approximately 3% (80% deduction applied to the new 15% corporate base).
- The math: 12.5% base × 20% taxable equals 2.5% before the reform; 15% × 20% equals 3.0% after the reform. The reform does not break the IP Box.
- Qualifying assets: copyrighted software code, patented inventions, and certain utility models. Trademarks, brands, and marketing-only assets do NOT qualify (BEPS Action 5 alignment).
- The nexus fraction caps the benefit by the share of R&D done by the Cyprus company itself or by unrelated subcontractors.
- A typical SaaS invoice splits roughly 70% to 85% qualifying subscription / IP income and 15% to 30% non-qualifying services (onboarding, support, custom integration). Only the IP portion gets the 3%.
- Worked example: a €2M ARR SaaS with an 80% qualifying mix and full nexus saves about €240,000 a year versus a flat 15% rate.
The Cyprus IP Box is the single most powerful piece of the Cyprus tax stack for software companies. It is also the single most misapplied. Most SaaS founders treat it as a flag they hoist over a Cyprus Ltd and assume 3% follows automatically. It does not. The headline number lives at the end of a chain of three calculations: which of your assets actually qualify, what share of your revenue is qualifying IP income, and what your nexus fraction is. Get any of those three wrong and you can leave half the benefit on the table.
This guide breaks the IP Box down for SaaS specifically. What qualifies, how to split a subscription invoice between IP income and services, how the nexus fraction works in plain English, and how to defend the whole structure in an audit. The numbers below are based on the 2026 Cyprus tax framework: 15% headline corporate rate, IP Box untouched, deemed dividend distribution abolished, SDC on actual dividends at 5%.
The Problem: most SaaS founders apply the IP Box wrong
The four most common errors we see when a SaaS founder arrives mid-project, asking for an IP Box review:
One. The Cyprus Ltd is treated as the IP owner but the R&D is still done entirely by a non-Cyprus team. Under the OECD modified-nexus approach (which Cyprus follows in full), R&D done by related-party offshore developers scores zero against the qualifying expenditure. The nexus ratio crashes and the effective rate moves from 3% toward 15%.
Two. The trademark, the brand, and the customer list are bundled into the “IP” being claimed under the IP Box. Marketing assets are explicitly excluded. The IP Box covers copyrighted software code and patents, not your logo.
Three. The full invoice (subscription plus services plus support) is claimed as qualifying IP income. In reality, a SaaS invoice has two or three distinct revenue streams and only some of them qualify. The non-qualifying portion sits at the headline 15%.
Four. There is no annual IP profit calculation. The IP Box requires the company to maintain a specific income-and-expense profile for the qualifying IP, year by year, and to file it with the tax return. Skip this and the entire claim is exposed at audit.
The Solution: how the Cyprus IP Box actually works
The mechanic, in plain English:
- Identify the qualifying intangible assets (your software, your patents, your utility models).
- Calculate the income attributable to those assets (subscription revenue, licensing fees, embedded royalty in a bundled product).
- Deduct the direct expenses of generating that income (R&D spend, hosting attributable to the IP, employee costs).
- Apply the nexus fraction to that net IP profit.
- Apply the 80% deduction.
- Pay 15% corporate tax on what remains.
The arithmetic looks like this on €1M of net IP profit, full nexus:
| Step | Amount |
|---|---|
| Net qualifying IP profit | €1,000,000 |
| Nexus fraction (assume full at 1.0) | €1,000,000 |
| 80% deduction | (€800,000) |
| Taxable amount | €200,000 |
| Corporate tax at 15% | €30,000 |
| Effective rate | 3.0% |
Before the 2026 reform the same calculation produced 2.5% (12.5% × 20%). The difference of 50 basis points is real, but it is small compared to the 12 to 17 percentage points of gap versus standard EU corporate rates.
We will review your revenue split, nexus, and documentation in a 30-minute call.
The nexus fraction in plain English
The nexus fraction is the OECD’s way of saying: “you get the IP Box benefit in proportion to the R&D you actually do yourself.” The formula is:
Nexus = (qualifying expenditure × 1.3) ÷ overall expenditure, capped at 1.0.
“Qualifying expenditure” means R&D performed by the Cyprus IP-owning company itself, plus R&D outsourced to unrelated third parties. “Overall expenditure” adds back two extra categories: R&D outsourced to related parties (your foreign sister company, the founder’s offshore consulting LLC) and acquisition cost of the IP itself.
The 30% uplift on the qualifying expenditure is designed to give a small cushion for the IP acquisition or related-party piece. In practice, for a typical SaaS that does most of its own coding in Cyprus, the nexus fraction lands at 1.0 (full benefit). For a SaaS that bought its codebase from a related foreign company and has all its devs in another country, the nexus fraction might land at 0.3 or 0.4, cutting the benefit by 60% to 70%.
How to do it: the 6-step IP Box qualification process for SaaS
Step 1: Confirm your IP is qualifying. Your source code, patents, and utility models qualify. Your brand, domain, customer list, and trade secrets-only assets do not. Have a Cyprus advisor map your asset register to the qualifying categories before you start.
Step 2: Document the R&D function in Cyprus. At least one Cyprus-resident developer or technical lead, ideally more as you scale. Sprint logs, code commits, and design decisions need to be traceable to the Cyprus entity. This is the substance backbone of the entire claim.
Step 3: Split your revenue between qualifying IP income and non-qualifying services. A SaaS invoice typically splits as: subscription / per-seat / metered usage (qualifying IP income, 70% to 85% of revenue), implementation and onboarding (non-qualifying services, 5% to 15%), custom integration and consulting (non-qualifying services, 5% to 15%), support (mixed, often non-qualifying). Document the split in your master subscription agreement.
Step 4: Calculate net IP profit annually. Strip direct R&D costs, hosting attributable to the IP, and the IP-attributable share of employee costs from the qualifying revenue. The result is your net IP profit, which is the base for the 80% deduction.
Step 5: Calculate the nexus fraction. Compile the qualifying expenditure (in-house Cyprus R&D plus unrelated third-party R&D), the overall expenditure (everything plus related-party offshore R&D plus IP acquisition cost), and apply the formula above.
Step 6: File the IP Box claim with the corporate tax return. The Cyprus tax return includes specific schedules for IP Box claims. The qualifying assets, the income split, the expenditure breakdown, and the nexus fraction all need to be disclosed. Get this filing right in year one and the future years follow the same template.
The Trap: five mistakes that kill IP Box claims
Trap #1: No documented R&D records. Sprint logs, code commits, design documents, and developer timesheets are the only audit-defensible evidence that R&D happened in Cyprus. If your entire claim relies on an org chart and a Slack screenshot, it will not hold.
Trap #2: Treating the trademark as IP Box-qualifying. Trademarks and brands are explicitly excluded. Your software code is what qualifies. Confusing the two leads to a partial or full disallowance.
Trap #3: Undocumented related-party subcontractor split. If 60% of your R&D is done by a related foreign sister company, that 60% sits outside the qualifying expenditure and drags the nexus fraction down. Map this on day one, not at the first audit.
Trap #4: No annual IP profit calculation. The IP Box is not “claim once and forget.” Each year, the qualifying assets, the IP income, the IP expenses, and the nexus fraction must be recalculated and disclosed. Companies that file the IP Box once and roll forward without recalculation are the easiest audit target.
Trap #5: An IP holding company in Cyprus with all the developers in another country. A pure IP holding structure scores a low nexus, particularly if the IP was acquired from a related party. The IP Box is designed to reward genuine R&D in Cyprus, not relabel offshore activity.
The Result: €2M ARR SaaS worked example
Consider a SaaS with €2M ARR, 75% gross margin, €1.5M EBITDA. Revenue mix: €1.6M qualifying subscription (80%), €0.4M non-qualifying services (20%). R&D fully in-house in Cyprus, nexus fraction 1.0.
| Item | Flat 15% Cyprus (no IP Box) | Cyprus + IP Box on 80% mix |
|---|---|---|
| Qualifying IP profit (80% of EBITDA) | n/a | €1,200,000 |
| Non-qualifying profit (20% of EBITDA) | n/a | €300,000 |
| Tax on qualifying portion (3% effective) | n/a | €36,000 |
| Tax on non-qualifying portion (15%) | n/a | €45,000 |
| Tax on full €1.5M at flat 15% | €225,000 | n/a |
| Total corporate tax | €225,000 | €81,000 |
Savings: about €144,000 per year versus a flat 15% Cyprus structure, and well over €400,000 per year versus a 25% to 30% EU jurisdiction. The IP Box is the lever that turns “Cyprus is fine” into “Cyprus is unambiguously the right choice.”
Frequently Asked Questions
Does my code need to be patented to qualify?
No. Copyrighted software is explicitly listed as a qualifying asset. Patent registration is helpful for documentation but not required. What is required is that the code is the IP of the Cyprus company and that the R&D was performed in line with the nexus framework.
Can open-source contributions kill my IP Box claim?
Open-source dependencies in your stack are fine. What matters is the original code you create. If parts of your codebase are themselves licensed under permissive open-source licences for others to use, only the proprietary, revenue-generating portions feed the IP Box claim.
Can a US LLC own the IP and license it to my Cyprus company?
That would invert the structure. The IP Box only benefits the entity that owns and exploits the qualifying IP. A US LLC owner licensing to a Cyprus operating company means the Cyprus entity is a licensee, not the IP owner, and the IP Box does not apply on the Cyprus side.
Can I use the IP Box with Estonian developers?
Yes, but it depends on whether they are related-party or unrelated-party. Unrelated third-party developers in Estonia count as qualifying expenditure for the nexus fraction. A related Estonian sister company does not. Structure the contracting accordingly.
Do I lose the IP Box if I exit the company?
The IP Box benefit attaches to the qualifying income while the Cyprus company holds the IP. On exit, the structure for capital gains is separate (and Cyprus does not tax capital gains on shares of operating companies). Plan the exit with the IP Box and capital gains framework together.
How often does the IP Box need to be filed?
Annually, with the corporate tax return. The qualifying income, expenditure, and nexus fraction need to be recalculated each year. See our annual compliance calendar for filing deadlines.
Talk to KTC About Your IP Box Setup
We have set up the IP Box for SaaS companies ranging from solo founders with €200k ARR to scaled teams running €20M+ in subscription revenue. The mechanics are the same, the documentation rigour scales with size, and the audit posture changes when the absolute tax savings cross seven figures. One 30-minute call usually tells you whether the IP Box is the right priority for your stage.